)]}'
{"nova/virt/libvirt/driver.py":[{"author":{"_account_id":1779,"name":"Daniel Berrange","email":"berrange@redhat.com","username":"berrange"},"change_message_id":"ead34e1edfd139ec815bdced63ccf6c6750e2aa7","unresolved":false,"context_lines":[{"line_number":5742,"context_line":"                # not possible to use VIR_MIGRATE_TUNNELLED flag while doing"},{"line_number":5743,"context_line":"                # block migration. Remove flag here"},{"line_number":5744,"context_line":"                if device_names and migrate_data.block_migration:"},{"line_number":5745,"context_line":"                    migration_flags \u0026\u003d ~libvirt.VIR_MIGRATE_TUNNELLED"},{"line_number":5746,"context_line":"                params \u003d {"},{"line_number":5747,"context_line":"                    \u0027bandwidth\u0027: CONF.libvirt.live_migration_bandwidth,"},{"line_number":5748,"context_line":"                    \u0027destination_xml\u0027: new_xml_str,"}],"source_content_type":"text/x-python","patch_set":1,"id":"7aa08908_b3b8dee6","line":5745,"updated":"2016-06-07 08:32:38.000000000","message":"So this is silently ignoring the tunnelled flag when doing block migration. So when \"normal\" migration is done, the connection is secure as its tunnelled over libvirt and no extra network ports need be allowed by the firewall. When block migraiton is done, the connection is made direct between both QEMUs, requiring extra firewall ports, and also being now insecure in plaintext. I don\u0027t really think we should silently switch off tunnelled like this, given the implications to security.\n\nInstead, I think we need to deal with this when Nova compute initially starts up.\n\nIf the admin has *not* explicitly requested tunnelling in the config file, then we should simply never set the tunnelled flag if we have new enough libvirt to support the new NBD based block migration, as that combination is never valid.\n\nIf the admin *has* explicitly requested tunnelling in the config file and we have a new enough libvirt to support NBD based block migration, we must raise an error as that\u0027s an impossible combination to support.\n\nWe should validate this in _parse_migration_flags","commit_id":"0a706f921246b68de911b61287e711587e99eaba"},{"author":{"_account_id":14819,"name":"Timofey Durakov","email":"timofei.nd@gmail.com","username":"tdurakov"},"change_message_id":"c68c54ac7556be727faec8bbcd57e63734a97d59","unresolved":false,"context_lines":[{"line_number":5742,"context_line":"                # not possible to use VIR_MIGRATE_TUNNELLED flag while doing"},{"line_number":5743,"context_line":"                # block migration. Remove flag here"},{"line_number":5744,"context_line":"                if device_names and migrate_data.block_migration:"},{"line_number":5745,"context_line":"                    migration_flags \u0026\u003d ~libvirt.VIR_MIGRATE_TUNNELLED"},{"line_number":5746,"context_line":"                params \u003d {"},{"line_number":5747,"context_line":"                    \u0027bandwidth\u0027: CONF.libvirt.live_migration_bandwidth,"},{"line_number":5748,"context_line":"                    \u0027destination_xml\u0027: new_xml_str,"}],"source_content_type":"text/x-python","patch_set":1,"id":"7aa08908_fea69f51","line":5745,"in_reply_to":"7aa08908_b3b8dee6","updated":"2016-06-07 12:16:34.000000000","message":"Daniel, _parse_migration_flags is executed during compute startup, so it should make validation only one time. What flags should nova validate? is it enough to check live_migration_tunnelled, or we should validate block_migration_flag and live_migration_flag too? E.g. env uses libvirt newer than 1.2.17 and the admin requested tunnelling by setting live_migration_tunnelled\u003dTrue, there is still opportunity that instances are located on shared storage, or for example don\u0027t use config drive, so there is no need in block migration, should we raise in that case exception during host startup or validate each live_migration request, because it\u0027s calculated per instance rather than per host?\nP.S. agree that we shouldn\u0027t silently remove tunnelling.","commit_id":"0a706f921246b68de911b61287e711587e99eaba"},{"author":{"_account_id":12299,"name":"Paweł Koniszewski","email":"pawel.koniszewski@gmail.com","username":"pawel.koniszewski"},"change_message_id":"ae1bbc521c8078de4802be88259bd3b216fa1a42","unresolved":false,"context_lines":[{"line_number":5742,"context_line":"                # not possible to use VIR_MIGRATE_TUNNELLED flag while doing"},{"line_number":5743,"context_line":"                # block migration. Remove flag here"},{"line_number":5744,"context_line":"                if device_names and migrate_data.block_migration:"},{"line_number":5745,"context_line":"                    migration_flags \u0026\u003d ~libvirt.VIR_MIGRATE_TUNNELLED"},{"line_number":5746,"context_line":"                params \u003d {"},{"line_number":5747,"context_line":"                    \u0027bandwidth\u0027: CONF.libvirt.live_migration_bandwidth,"},{"line_number":5748,"context_line":"                    \u0027destination_xml\u0027: new_xml_str,"}],"source_content_type":"text/x-python","patch_set":1,"id":"7aa08908_67485e88","line":5745,"in_reply_to":"7aa08908_fea69f51","updated":"2016-06-07 12:52:57.000000000","message":"We can\u0027t do that during init if we don\u0027t check all VMs in the environment. Otherwise it does not make sense. We also can\u0027t just remove tunnelling, because not all VMs will requires selective disk migration.","commit_id":"0a706f921246b68de911b61287e711587e99eaba"}]}